Jefferson
Gakuya

I was handed a dental practice’s requirements and an empty repository. Before any UI, I modelled the domain: patients, appointments, clinicians, treatments, inventory and invoices, nine entities in all, with PostgreSQL row-level security so each role only ever sees its own slice of the data.

The modules cover scheduling, clinical records, tooth charting with an interactive 3D dental arch (React Three Fiber, FDI notation), and invoicing that satisfies Kenya’s eTIMS tax requirements.

Along the way I worked through seven separate end-to-end CI failures and set one rule for the team: nothing is “done” until you can say where it was verified, whether local, CI or production. It removed most of our “works on my machine” arguments.

• React Router v7
• TypeScript
• NestJS
• Supabase
• Playwright
• Three.js

Our client apps (NestJS, Next.js and SQL Server) run on Coolify across several Hetzner servers, with Traefik routing traffic and handling TLS for four-plus production domains. When something breaks, it usually lands with me.

A few that did: a host with IPv6 assigned but no working IPv6 route, so every Docker image pull timed out until I forced IPv4 precedence for the Docker daemon. Resources created without an https:// scheme, which quietly produced broken Traefik routers and no certificates. The same domains configured on two servers, so Let’s Encrypt renewals kept failing on one of them.

Reading the access logs also turned up active webshell-scanning campaigns, which led to a hardening pass covering SSH, the Docker socket, secrets and exposed database ports. I wrote the checks down as a diagnostic runbook the rest of the team can use.

• Docker
• Coolify
• Traefik
• Linux
• Let’s Encrypt

The brief was to take payments through both Peach Payments and iPay without tying business logic to either vendor’s API. I modelled the domain around a PaymentPort interface, so the application layer never knows which provider is running.

Each provider lives in its own adapter behind that port. The domain emits the same PaymentInitiated and PaymentSettled events whichever one handled the money, which gives one audit trail and lets retries stay idempotent at the boundary.

Adding or swapping a provider is now one new adapter and its tests, with no changes to the business rules. I’ve since used the same pattern for M-Pesa STK Push and Paystack.

• Node.js
• TypeScript
• AWS Lambda
• M-Pesa
• Paystack

Field crews lose signal constantly, so the app has to work fully offline. A local SQLite store is the source of truth for every read and write; the UI never calls the remote API directly.

A background sync engine queues each mutation with a monotonic sequence ID and flushes to the API when the device reconnects. Conflicts resolve last-write-wins per field, with a merge fallback for list fields where last-write-wins would lose data.

The engine publishes its state (syncing, pending or error), which drives a small connectivity banner, so users know where they stand without needing to understand replication.

• React Native
• SQLite
• TypeScript

Pulse turns football match events into live metrics, key moments and commentary. I own the Go side: a seeded, deterministic 11v11 match generator that regenerates byte-for-byte, the metrics and moment detectors, the HTTP/SSE API and the web UI.

The design rule is “facts first, LLM second”. Go computes every number, and the AI agents may only narrate from a verified fact pack, with a verifier checking each claim before a viewer sees it. A 10-step CI gate guards it all, from gofmt to Bicep builds for Azure Container Apps.

• Go
• Server-Sent Events
• TypeScript
• Azure Container Apps
• Bicep